Inductive Assertion Method Research Articles

Applying Floyd’s Inductive Assertions Method for Verification of Generalized Net Models Without Temporal Components

Generalized Nets are extensions of Petri Nets. They are a suitable tool for describing real sequential and parallel processes in different areas. The implementation of correct Generalized Nets models is a task of great importance for the creation of a number of applications such as transportation management, e-business, medical systems, telephone networks, etc. The cost of an error in the models of some of these applications can be very high. The implementation of models of similar applications has to use formal approaches to prove that the developed models are correct. A foundation stone of software verification, which is suitable for verification of Generalized Nets models with transitions without temporal component, is Floyd’s inductive assertion method. This article presents a modification of Floyd’s inductive assertion method for verification of flowcharts, which allows Generalized Nets without temporal component to be verified. Using an illustrative example, we show that the offered adaptation is appropriate for the purpose of training university students in the Informatics and Computer Sciences in formal methods of verification.

Verification of quantum programs

This paper develops verification methodology for quantum programs, and the contribution of the paper is two-fold. •Sharir, Pnueli and Hart [M. Sharir, A. Pnueli, S. Hart, Verification of probabilistic programs, SIAM Journal of Computing 13 (1984) 292–314] presented a general method for proving properties of probabilistic programs, in which a probabilistic program is modeled by a Markov chain and an assertion on the output distribution is extended to an invariant assertion on all intermediate distributions. Their method is essentially a probabilistic generalization of the classical Floyd inductive assertion method. In this paper, we consider quantum programs modeled by quantum Markov chains which are defined by super-operators. It is shown that the Sharir–Pnueli–Hart method can be elegantly generalized to quantum programs by exploiting the Schrödinger–Heisenberg duality between quantum states and observables. In particular, a completeness theorem for the Sharir–Pnueli–Hart verification method of quantum programs is established.•As indicated by the completeness theorem, the Sharir–Pnueli–Hart method is in principle effective for verifying all properties of quantum programs that can be expressed in terms of Hermitian operators (observables). But it is not feasible for many practical applications because of the complicated calculation involved in the verification. For the case of finite-dimensional state spaces, we find a method for verification of quantum programs much simpler than the Sharir–Pnueli–Hart method by employing the matrix representation of super-operators and Jordan decomposition of matrices. In particular, this method enables us to compute easily the average running time and to analyze some interesting long-run behaviors of quantum programs in a finite-dimensional state space.

Inductive assertion method for logic programs

Certain properties of logic programs are inexpressible in terms of their declarative semantics. One example of such properties would be the actual form of procedure calls and successes which occur during computations of a program. They are often used by programmers in their informal reasoning. In this paper, the inductive assertion method for proving partial correctness of logic programs is introduced and proved sound. The method makes it possible to formulate and prove properties which are inexpressible in terms of the declarative semantics. An execution mechanism using the Prolog computation rule and arbitrary search strategy (e.g., OR-parallelism or Prolog backtracking) is assumed. The method may also be used to specify the semantics of some extra-logical built-in procedures for which the declarative semantics is not applicable.

Proofs of partial correctness for attribute grammars with applications to recursive procedures and logic programming

An extension of the inductive assertion method allowing one to prove the partial correctness of an attribute grammar w.r.t. a specification is presented. It is complete in an abstract sense. It is also shown that the semantics of systems of recursive imperative procedures or of recursive applicative procedures computed with call-by-value or call-by-name can be expressed by an attribute grammar associating attributes with the nodes of the so-called trees of calls. Hence the proof methods for the partial correctness of attribute grammars can be applied to these recursive procedures. We show also how the proof method can be applied in logic programming.

The use of hoare logic in the verification of horizontal microprograms

In recent years, much effort has been devoted to the design and implementation of microprogramming languages that support the production of highly reliable yet efficient run time microcode. One of the goals for such languages is to facilitate the formal verification of microprograms using Hoare's inductive assertion method. Essential to the use of this method is an axiomatic definition of the microprogramming language.

An Inductive Assertion Method for Register Transfer Level Design Verification

This paper extends Floyd's inductive assertion method to formal verification of register transfer level (RTL) hardware descriptions. An RTL description with imbedded assertions about machine state will be the input to the verifier. The formal semantics of an RTL language for synchronous designs are defined, to make mechanical generation of verification conditions (VC's) possible. These VC's are to be fed to a theorem prover. Proof of all the VC's constitutes complete verification. The semantic rules define how time advances, in addition to how machine variables change. These rules make possible verification of real-time performance as well as logical correctness. Such real-time performance verification is important for some hardware designs. The paper also emphasizes the differences between software and hardware verification. An example is given to illustrate the formal verification method.

Axiomatic proof rules for a machine-specific microprogramming language

In recent years, much effort has been devoted to the design and implementation of high level microprogramming languages. One of the goals for such languages is to facilitate the formal verification of microprograms using Hoare's inductive assertion method. Essential to the use of this method is an axiomatic definition of the microprogramming language.In this paper, we describe the axiomatization of the machine dependent microprogramming language S*(QM-1) [12]. This language is an instantiation of the machine independent language schema S* [3,4], for the Nanodata QM-1 "nanolevel" architecture. We show that, in spite of the complexity of the QM-1, with its variety of side-effects and special conditions, a small and uniform set of proof rules can be constructed.

Nondeterministic flowchart programs with recursive procedures: semantics and correctness I

In this paper, we study some aspects of the semantics of nondeterministic flowchart programs with recursive procedures. In the first part of this work we provide the operational semantics of programs using the concept of an execution tree. We propose a new definition of the semantics of a non-deterministic recursive program as a mapping from the input domain to the set of execution trees determined by the program. Using this new concept, we prove that every nondeterministic flowchart program with recursive procedures can be unfolded into a semantically equivalent infinite pure flowchart (without procedures). This result is applied in the second part of this work to prove the soundness of an inductive assertion method which is also complete with a finite number of assertions (contrary to De Bakker and Meertens's method [11]).

Nondeterministic flowchart programs with recursive procedures: Semantics and correctness II

In the second part of this work, we formulate a new inductive assertion method applying to the class of nondeterministic flowchart programs with recursive procedures studied in part 1. Using results on unfolding proved in part 1, we prove that this method is sound and complete with a finite number of assertions. We study four notions of correctness: two notions of partial correctness (existential and universal) and the corresponding notions of total correctness. We also formalize two notions of extension and equivalence (existential and universal) in the second-order predicate calculus.

A Linear Time Algorithm for Finding Minimum Cutsets in Reducible Graphs

The analysis of many processes modeled by directed graphs requires the selection of a subset of vertices which cut all the cycles in the graph. Reducing the size of such a cutset usually leads to a simpler and more efficient analysis, but the problem of finding minimum cutsets in general directed graphs is known to be $NP$-complete. In this paper we show that in reducible graphs (and thus in almost all the “practical” flowcharts of programs), minimum cutsets can be found in linear time. We further show that the linear algorithm can check its own applicability to a given graph, thus eliminating the need of prechecking (in nonlinear time) whether it is reducible or not. An immediate application of this result is in program verification systems based on Floyd’s inductive assertions method.

Subgoal induction

A proof method, subgoal induction, is presented as an alternative or supplement to the commonly used inductive assertion method. Its major virtue is that it can often be used to prove a loop's correctness directly from its input-output specification without the use of an invariant. The relation between subgoal induction and other commonly used induction rules is explored and, in particular, it is shown that subgoal induction can be viewed as a specialized form of computation induction. A set of sufficient conditions are presented which guarantee that an input-output specification is strong enough for the induction step of a proof by subgoal induction to be valid.

Proving the Correctness of Multiprocess Programs

The inductive assertion method is generalized to permit formal, machine-verifiable proofs of correctness for multiprocess programs. Individual processes are represented by ordinary flowcharts, and no special synchronization mechanisms are assumed, so the method can be applied to a large class of multiprocess programs. A correctness proof can be designed together with the program by a hierarchical process of stepwise refinement, making the method practical for larger programs. The resulting proofs tend to be natural formalizations of the informal proofs that are now used.

Strum: Structured Microprogram Development System for Correct Firmware

An approach to the development of correct microprograms is to use the methodologies that have been beneficial in the generation of correct user programs, i. e., structured programming, high-level languages (HLL's), and formal program verification using Floyd's inductive assertion method. This paper presents a system that combines these techniques to simplify the design and implementation of correct microprograms for a real microprogrammable computer. It gives some statistics which support our emphasis on generation as well as correctness and some preliminary results on the use of our system.

Proving the correctness of a flight-director program for an airborne minicomputer

Over the past five years, our research efforts have been devoted in large part to developing techniques for proving the correctness of assembly-language and machine-language programs running on actual computers. In this paper, we report upon an effort to put this work into practice by proving the correctness of a program written for the Litton C4000 airborne computer. This includes overflow analysis, non-self-modification analysis, round-off and truncation analysis, fixed-point scaling considerations, and analysis of the sub-routine parameter and return-address conventions used in the given program. The basic method we use is the inductive assertion method of (Floyd, 1967), suitably modified and extended for application to a machine-language situation.

Proving the correctness of a flight-director program for an airborne minicomputer

Over the past five years, our research efforts have been devoted in large part to developing techniques for proving the correctness of assembly-language and machine-language programs running on actual computers. In this paper, we report upon an effort to put this work into practice by proving the correctness of a program written for the Litton C4000 airborne computer. This includes overflow analysis, non-self-modification analysis, round-off and truncation analysis, fixed-point scaling considerations, and analysis of the subroutine parameter and return-address conventions used in the given program. The basic method we use is the inductive assertion method of (Floyd, 1967), suitably modified and extended for application to a machine-language situation.

On the completeness of the inductive assertion method

Manna's theorem on (partial) correctness of programs essentially states that in the statement of the Floyd inductive assertion method, “A flow diagram is correct with respect to given initial and final assertions if suitable intermediate assertions can be found”, we may replace “if” by “if and only if”. In other words, the method is complete . A precise formulation and proof for the flow chart case is given. The theorem is then extended to programs with (parameterless) recursion; for this the structure of the intermediate assertions has to be refined considerably. The result is used to provide a characterization of recursion which is an alternative to the minimal fixed point characterization, and to clarify the relationship between partial and total correctness. Important tools are the relational representation of programs, and Scott's induction.

Verifying programs which operate on data structures

In order to prove the correctness of a computer program, one must be able to characterize the data in the program. Proofs by the inductive assertion method require the construction of concise, precise assertions to describe the data. This paper presents some techniques for characterizing data structures which can be used to build adequate assertions. New primitive relations are introduced for describing intra-structural relationships. These primitives form the basis for two important concepts: The invariant of a structure is a concise characterization of a structural class. A representation function is a mapping from a structure to a corresponding abstract data object; this concept provides a means for expressing relationships between a structure and other data, and among the values of a structure over time. By means of verification lemmas, these concepts can be integrated into proofs of correctness, and the proofs as well as the assertions can be dramatically simplified. An example program is presented which demonstrates the use of these concepts in constructing the assertions, and the resulting proof of correctness is outlined.

An interactive program verification system

This paper is an initial progress report on the development of an interactive system for verifying that computer programs meet given formal specifications. The system is based on the conventional inductive assertion method: given a program and its specifications, the object is to generate the verification conditions, simplify them, and prove what remains. The important feature of the system is that the human user has the opportunity and obligation to help actively in the simplifying and proving. The user, for example, is the primary source of problem domain facts and properties needed in the proofs. A general description is given of the overall design philosophy, structure, and functional components of the system, and a simple sorting program is used to illustrate both the behavior of major system components and the type of user interaction the system provides.

An interactive program verification system

This paper is an initial progress report on the development of an interactive system for verifying that computer programs meet given formal specifications. The system is based on the conventional inductive assertion method: given a program and its specifications, the object is to generate the verification conditions, simplify them, and prove what remains. The important feature of the system is that the human user has the opportunity and obligation to help actively in the simplifying and proving. A general description is given of the overall design philosophy, structure, and functional components of the system, and a simple sorting program is used to illustrate both the behavior of major system components and the type of user interaction the system provides.